# HG changeset patch
# User DJ Mountney <dj@gitlab.com>
# Date 1613079034 28800
#      Thu Feb 11 13:30:34 2021 -0800
# Node ID 639f301c10a4d4f8422f99ac682418488e021200
# Parent  6c81e7db5755c48beb007bf9015c25f06f7f6e5f
Merged branch "hufa/omnibus-gitlab-master" into "master"

MR: https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/4953

diff --git a/changelogs/unreleased/hufa-fix-docker-pam.yml b/changelogs/unreleased/hufa-fix-docker-pam.yml
new file mode 100644
--- /dev/null
+++ b/changelogs/unreleased/hufa-fix-docker-pam.yml
@@ -0,0 +1,5 @@
+---
+title: configure sshd and git account so that pam is not used any longer in docker
+merge_request: 4953
+author: Fnordpol
+type: fixed
diff --git a/docker/Dockerfile b/docker/Dockerfile
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -17,8 +17,7 @@
       tzdata \
       nano \
       less \
-    && rm -rf /var/lib/apt/lists/* \
-    && sed 's/session\s*required\s*pam_loginuid.so/session optional pam_loginuid.so/g' -i /etc/pam.d/sshd
+    && rm -rf /var/lib/apt/lists/*
 
 # Remove MOTD
 RUN rm -rf /etc/update-motd.d /etc/motd /etc/motd.dynamic
diff --git a/docker/assets/setup b/docker/assets/setup
--- a/docker/assets/setup
+++ b/docker/assets/setup
@@ -46,7 +46,9 @@
 groupadd -g 991 gitlab-consul
 
 # Create accounts
-useradd -m -u 998 -g git -m -s /bin/sh -d /var/opt/gitlab git
+## The git account is created with * as crypted password as ssh treats the account as locked if it has a ! 
+## Issue #5891 https://gitlab.com/gitlab-org/omnibus-gitlab
+useradd -m -u 998 -g git -p '*' -m -s /bin/sh -d /var/opt/gitlab git
 useradd -m -u 999 -g gitlab-www -m -s /bin/false -d /var/opt/gitlab/nginx gitlab-www
 useradd -m -u 997 -g gitlab-redis -m -s /bin/false -d /var/opt/gitlab/redis gitlab-redis
 useradd -m -u 996 -g gitlab-psql -m -s /bin/sh -d /var/opt/gitlab/postgresql gitlab-psql
diff --git a/docker/assets/sshd_config b/docker/assets/sshd_config
--- a/docker/assets/sshd_config
+++ b/docker/assets/sshd_config
@@ -15,9 +15,10 @@
 AuthorizedKeysCommand /opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell-authorized-keys-check git %u %k
 AuthorizedKeysCommandUser git
 
-# Fix: User username not allowed because account is locked
 # With "UsePAM yes" the "!" is seen as a password disabled account and not fully locked so ssh public key login works
-UsePAM yes
+# Please make sure that the account is created without passwordlogin ("*" in /etc/shadow) or configure pam. 
+# Issue #5891 https://gitlab.com/gitlab-org/omnibus-gitlab
+UsePAM no
 
 # Disabling use DNS in ssh since it tends to slow connecting
 UseDNS no